Feature · The flip side of vibe coding

106 'online temples' later, who pays the server bill and checks security? 60 run on free default domains, and 16,000 Supabase databases were found open

Since Sansa, Korea's "places where strangers hang out together" have grown to 106 sites (AI News Daily count, Oct. 31 afternoon). Most were built by solo developers with AI coding tools in days or a few weeks. When crowds arrive, free servers hit their limits and stop, and AI-written code sometimes ships with the database door wide open. Here is what builders and users should know about server costs and security, with a cost estimate at Sansa's scale and a checklist.

1. 60 of 106 run on free default domains

   AI News Daily counted the addresses of the 106 sites in 'Trending now · Metaverse': 60 use the default domain a host hands out on sign-up. That is 25 on Cloudflare Workers (workers.dev), 11 on Vercel (vercel.app), 6 on Cloudflare Pages (pages.dev), 5 each on GitHub Pages and Render (onrender.com), and 3 each on Netlify and ChatGPT sites (chatgpt.site). The other 46 use their own domains.

2. Even Sansa went down on day one: real-time is not a homepage

   Sites that stream everyone's movements in a shared room work servers far harder than pages that just show text. The original Sansa crashed under the rush. Its developer apologized and raised the room cap from 20 to 100, then 1,200, then 10,000. On Oct. 30 morning, 4,679 people sat across 100 servers of one hall.

3. The free-tier wall: errors past the limit, a month-long suspension

   On Cloudflare's free plan, Durable Objects, which hold shared state for many users, allow 100,000 requests a day, with 20 WebSocket messages counted as one. Past the limit, that operation fails until midnight UTC. Render's free web services sleep after 15 minutes without traffic and take about a minute to wake. Use up the 750 monthly hours and all free services stop until the month ends; with a card on file, extra bandwidth is billed. Going viral can mean going down, or a bigger bill.

4. More than 16,000 Supabase databases were open

   Security firm UpGuard said in September it checked about 300,000 domains using Supabase and found 16,326 databases with tables anyone could read. Over half showed signs of personal data, and some held passwords or auth tokens. UpGuard's common thread: the sites were created by AI coding agents and the humans were unaware of the database configuration, regardless of business type.

5. Moltbook leaked 1.5M tokens through one key

   Moltbook, a vibe-coded social network for AI agents, had its whole database exposed in late January. Per Wiz, a Supabase key sat in client-side JavaScript with Row Level Security off, so that key alone allowed reading and writing about 1.5 million API tokens, some 35,000 email addresses and about 4,000 agent-to-agent messages. Wiz reported it on Jan. 31 and all tables were locked down on Feb. 1.

6. Holes in the builder tools too: Lovable's 48 days

   Sometimes the app builder itself is the hole. The Next Web reported in April that on vibe-coding platform Lovable, five API calls from a free account could reveal other users' source code and database credentials, a flaw left open for 48 days. Lovable first said it "did not suffer a data breach," then partially apologized the same day.

7. Estimated server bill: $25 to $560 a month at Sansa's scale

   We priced Sansa's scale (100,000 visitors a day, 100 rooms, up to 100 people per room) with Cloudflare's published rates. The paid plan has a $5 monthly minimum, includes 1 million requests and 400,000 GB-s of duration, then charges $0.15 per million requests and $12.50 per million GB-s; 20 WebSocket messages count as one request. If users only send occasional signals like a bow (one message every 2 seconds each), that is roughly $25 a month; streaming walking positions 10 times a second per user brings it to about $150. Skip the Hibernation API, which stops billing duration for idle connections, and the same traffic costs $420 to $560. Cloudflare's own example of 100 objects with 100 connections each shows $12.50 in duration with hibernation and $412.50 without. Messages per second is the biggest lever, so batching positions instead of sending every frame cuts costs sharply. The usage patterns are AI News Daily's assumptions and real numbers may differ.

8. Seven security checks before launch

   One: keep secret keys such as Supabase service keys or OpenAI keys on the server, never in browser code; a public (anon) key is safe only with Row Level Security on. Two: turn on RLS for every table and, before launch, query with the public key yourself to confirm it is blocked; the 16,000 open databases and Moltbook all failed here. Three: let the server decide room caps, positions and actions; drop out-of-bounds coordinates and oversized messages, and cap messages per second per connection. Four: render nicknames, wishes and guestbooks as plain text with length limits; if you open chat, add reporting and a word filter. Five: check the Origin on WebSocket connections so other sites and bots can't join your rooms. Six: set spending caps and budget alerts first; free plans stop at the limit, while paid plans with a card attached bill without end. Seven: when traffic spikes abnormally, switch on firewall rate limiting or a human check.

9. Other cautions: privacy, copyright, donations and handling a rush

   Storing IP addresses, nicknames or visit logs calls for a privacy policy; storing nothing is simplest, and with minors around, open chat carefully. Check licenses for sutra chanting or hymn recordings, Buddha or icon images and fonts, and if you borrow the name of a real cathedral or temple, say clearly the site is unofficial. Taking real money through features like 'offer rice' brings payment, tax and refund issues. For a rush, show a 'room full, try another' screen, keep a notice page that loads even when servers are down, and pick one social channel for outage updates. 3D scenes heat up and drain budget phones, so a low-quality mode reduces drop-off. Copycats with similar names appear the moment you take off, so buy your own domain early; 60 of the 106 sites still use free default addresses.